Bug 975378

Description of problem:
SELinux is preventing /usr/sbin/libvirtd from connectto access on the unix_stream_socket /run/libvirt/virtlockd-sock.

Version-Release number of selected component (if applicable):
Source RPM Packages           libvirt-daemon-1.0.5-2.el7.x86_64
Policy RPM                    selinux-policy-3.12.1-49.el7.noarch

How reproducible:
Always.

Steps to Reproduce:
1. There was no libvirt release with bug 973543 and bug 968128 fixed yet.

For libvirt 1.0.5 work around bug 968128 by adjusting the socket path manually:
In /usr/lib/systemd/system/virtlockd.socket set:
ListenStream=/var/run/libvirt/virtlockd-sock

Bug 973543 in 1.0.6 cannot be worked around, but both should be fixed in the next release.

2. Change the lock manager to lockd in /etc/libvirt/qemu.conf:
lock_manager = "lockd"

3. Request automatic disk leases in /etc/libvirt/qemu-lockd.conf:
auto_disk_leases = 1

4. Restart virtlockd and libvirtd services.

5. Try to start a domain with a disk:

qemu-img create -f qcow2 /var/lib/libvirt/images/cake.qcow2 10M

virsh create /dev/stdin <<EOF
<domain type='qemu'>
  <name>cake</name>
  <memory unit='MiB'>32</memory>
  <os>
    <type arch='x86_64' machine='pc'>hvm</type>
  </os>
  <devices>
    <emulator>/usr/libexec/qemu-kvm</emulator>
    <disk type='file' device='disk'>
      <driver name='qemu' type='qcow2'/>
      <source file='/var/lib/libvirt/images/cake.qcow2'/>
      <target dev='vda' bus='virtio'/>
    </disk>
  </devices>
</domain>
EOF

Actual results:
Domain fails to start:
error: Failed to create domain from /dev/stdin
error: Child quit during startup handshake: Input/output error

 and this error appears in /var/log/messages:
Jun 18 05:59:24 456rhel setroubleshoot: SELinux is preventing /usr/sbin/libvirtd from connectto access on the unix_stream_socket /run/libvirt/virtlockd-sock. For complete SELinux messages. run sealert -l 3568d43a-05a4-4b07-a805-c57c4e572b10

Expected results:
Domain starts.

Additional info:
SELinux is preventing /usr/sbin/libvirtd from connectto access on the unix_stream_socket /run/libvirt/virtlockd-sock.

*****  Plugin catchall (100. confidence) suggests  ***************************

If you believe that libvirtd should be allowed connectto access on the virtlockd-sock unix_stream_socket by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# grep libvirtd /var/log/audit/audit.log | audit2allow -M mypol
# semodule -i mypol.pp


Additional Information:
Source Context                system_u:system_r:svirt_tcg_t:s0:c533,c698
Target Context                system_u:system_r:initrc_t:s0
Target Objects                /run/libvirt/virtlockd-sock [ unix_stream_socket ]
Source                        libvirtd
Source Path                   /usr/sbin/libvirtd
Port                          <Unknown>
Host                          456rhel
Source RPM Packages           libvirt-daemon-1.0.5-2.el7.x86_64
Target RPM Packages           
Policy RPM                    selinux-policy-3.12.1-49.el7.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     456rhel
Platform                      Linux 456rhel 3.10.0-0.rc4.60.el7.x86_64 #1 SMP
                              Thu Jun 6 12:27:28 EDT 2013 x86_64 x86_64
Alert Count                   1
First Seen                    2013-06-18 05:59:22 EDT
Last Seen                     2013-06-18 05:59:22 EDT
Local ID                      3568d43a-05a4-4b07-a805-c57c4e572b10

Raw Audit Messages
type=AVC msg=audit(1371549562.105:202): avc:  denied  { connectto } for  pid=1117 comm="libvirtd" path="/run/libvirt/virtlockd-sock" scontext=system_u:system_r:svirt_tcg_t:s0:c533,c698 tcontext=system_u:system_r:initrc_t:s0 tclass=unix_stream_socket


type=SYSCALL msg=audit(1371549562.105:202): arch=x86_64 syscall=connect success=no exit=EACCES a0=3 a1=7f66606b4e20 a2=6e a3=6b636f732d646b items=0 ppid=1 pid=1117 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 ses=4294967295 tty=(none) comm=libvirtd exe=/usr/sbin/libvirtd subj=system_u:system_r:virtd_t:s0-s0:c0.c1023 key=(null)

Hash: libvirtd,svirt_tcg_t,initrc_t,unix_stream_socket,connectto